66 matches found
CVE-2026-47359: Improper Neutralization of Special Elements used in an OS Command
Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Apache CloudStack's NAS backup provider plugin. The addBackupRepository API available since 4.20.0.0 and updateBackupRepository API introduced in 4.22.0.0 accept unsanitized command options f...
CVE-2026-70437
The Jenkins Webhook Secret Credentials Provider Plugin version 16.v0cfa_f0215cf5 and earlier is vulnerable to a timing attack because it fails to use a constant-time comparison function when validating webhook bearer tokens. This flaw could allow an attacker to use statistical methods to derive a...
CVE-2026-70437
Jenkins Webhook Secret Credentials Provider Plugin 16.v0cfaf0215cf5 and earlier does not use a constant-time comparison function when checking whether the provided and expected webhook bearer token are equal, potentially allowing attackers to use statistical methods to obtain a valid webhook bear...
CVE-2026-70437: Observable Timing Discrepancy
Jenkins Webhook Secret Credentials Provider Plugin 16.v0cfaf0215cf5 and earlier does not use a constant-time comparison function when checking whether the provided and expected webhook bearer token are equal, potentially allowing attackers to use statistical methods to obtain a valid webhook bear...
CVE-2026-67336
better-auth versions before 1.6.11 contain insecure cryptographic defaults in the oidcProvider and mcp plugins that advertise the none algorithm and accept plain PKCE by default. Attackers can exploit algorithm negotiation to accept unsigned tokens or intercept authorization codes when PKCE plain...
CVE-2026-67333
better-auth before 1.6.13 and pre-release builds 1.7.0-beta.0 through 1.7.0-beta.3 fail to validate the scheme of redirecturis registered via the deprecated oidc-provider plugin and the mcp plugin which wraps the same provider. An attacker can register an OAuth client with a javascript:...
GHSA-9H47-PQCX-HJR4 Better Auth has insecure cryptographic defaults in oidcProvider: alg=none advertised and plain PKCE accepted by default
Am I affected? Users are affected if all of the following are true: - Their application uses better-auth at a version below the patched release. - Their application enables oidcProvider from better-auth/plugins/oidc-provider or mcp from better-auth/plugins/mcp the mcp plugin delegates to...
EUVD-2015-9275
Malware in sbrugna...
EUVD-2022-5440
Malicious code in bioql PyPI...
EUVD-2025-16842
Malicious code in bioql PyPI...
EUVD-2022-5101
Malicious code in bioql PyPI...
CVE-2025-4578
The File Provider WordPress plugin through 1.2.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection...
CVE-2025-4578
The File Provider WordPress plugin through 1.2.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection...
CVE-2025-4580 File Provider <= 1.2.3 - Item Deletion via CSRF
The File Provider WordPress plugin through 1.2.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...
CVE-2025-4580 File Provider <= 1.2.3 - Item Deletion via CSRF
The File Provider WordPress plugin through 1.2.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...
CVE-2025-4578 File Provider <= 1.2.3 - Unauthenticated SQLi
The File Provider WordPress plugin through 1.2.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection...
WordPress plugin File Provider SQL注入漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. WordPress File Provider plugin suffers from a SQL injection vulnerability that stems from the application's lack of validation of externally entered SQL statements. An attacker...
PT-2025-23761 · WordPress · Filterprovider
Name of the Vulnerable Software and Affected Versions: File Provider versions 1.2.3 and earlier Description: The issue is related to the lack of a CSRF check when updating settings in the File Provider WordPress plugin. This could allow attackers to make a logged-in admin change the settings via ...
CVE-2023-24425
Jenkins Kubernetes Credentials Provider Plugin 1.208.v128ee9800c04 and earlier does not set the appropriate context for Kubernetes credentials lookup, allowing attackers with Item/Configure permission to access and potentially capture Kubernetes credentials they are not entitled to...